Standards for public agencies

2020 Edition

Client Rights (PA-CR) 2: Confidentiality and Privacy Protections

The agency protects the confidentiality of information about clients and assumes a protective role regarding the disclosure of confidential information.
2020 Edition

Currently viewing: CLIENT RIGHTS (PA-CR)

VIEW THE STANDARDS

Purpose

The rights and dignity of clients are respected throughout the agency.
1
Full Implementation, Outstanding Performance
A rating of (1) indicates that the agency's practices fully meet the standard and reflect a high level of capacity.  
  • All elements or requirements outlined in the standard are evident in practice, with rare or no exceptions: exceptions do not impact service quality or agency performance. 
2
Substantial Implementation, Good Performance
A rating of (2) indicates that an agency's infrastructure and practices are basically sound but there is room for improvement.
  • The majority of the standards requirements have been met and the basic framework required by the standard has been implemented. 
  • Minor inconsistencies and not yet fully developed practices are noted; however, these do not significantly impact service quality or agency performance.
3

Partial Implementation, Concerning Performance
A rating of (3) indicates that the agency's observed infrastructure and/or practices require significant improvement.  

  • The agency has not implemented the basic framework of the standard but instead has in place only part of this framework.  
  • Omissions or exceptions to the practices outlined in the standard occur regularly, or practices are implemented in a cursory or haphazard manner.  
  • Service quality or agency functioning may be compromised.  
  • Capacity is at a basic level.
4
Unsatisfactory Implementation or Performance
A rating of (4) indicates that implementation of the standard is minimal or there is no evidence of implementation at all.  
  • The agency’s observed administration and management infrastructure and practices are weak or non-existent; or show signs of neglect, stagnation, or deterioration.
Self-Study EvidenceOn-Site EvidenceOn-Site Activities
County/Municipality Administered Agency, State Administered Agency (Central Office), or other Public Entity
  • Confidentiality policy 
  • Confidentiality procedures
  • Sample release form for disclosure of confidential information
State Administered Agency (Regional Office)
  • No Self-Study Evidence
County/Municipality Administered Agency, State Administered Agency (Central Office), or other Public Entity
  • No On-Site Evidence

State Administered Agency (Regional Office)
  • Communications with staff regarding completing releases of information (memo, in-service training documentation, staff meeting minutes)
All Agencies
  • Interviews may include:
    1. Program director
    2. Relevant personnel
    3. Persons served
  • Review case records

Fundamental Practice

PA-CR 2.01

When the agency receives a request for confidential information about a client, or when the release of confidential information is necessary for the provision of services, prior to releasing such information, the agency:
  1. determines if the reason to release information is valid;
  2. obtains informed, written authorization to release the information from the client and/or parent or legal guardian, as appropriate; and
  3. maintains each authorization of consent in the case record and provides a copy to the client and/or parent or legal guardian.
Note: Please see the Case Record Checklist for additional guidance on this standard.

PA-CR 2.02

Prior to the disclosure of confidential or private information, the agency informs the client about circumstances when it may be legally or ethically permitted or required to release such information without his or her consent, and notifies the client of such a release when it occurs.
Examples: When permitted or required by law, regulation, or court order, confidential information may be released without the authorization of the client and legal guardian. The agency may wish to seek legal counsel, as necessary, when others seek identifying information about an individual or family, or when the release of confidential information is necessary for the provision of services.

PA-CR 2.03

The agency obtains informed, written consent from the client or a legal guardian prior to recording, photographing, or filming.

Interpretation

For Early Childhood Education (PA-ECE) or Out-of-School Time Services (PA-OST), it is not necessary to obtain consent each time children or youth may be recorded, photographed, or filmed; consent may be provided at enrollment and maintained in program records or files. Consents should be reviewed and updated annually. 

Juvenile Justice

Interpretation

In juvenile justice programs, when recording, photographing, or filming is required by law, consent may not be necessary. However, it is still expected that the agency inform clients prior to recording, photographing, or filming.
 
Note: Please see the Case Record Checklist for additional guidance on this standard.

Fundamental Practice

PA-CR 2.04

The release form for disclosure of confidential information includes the following elements:
  1. the name of the person whose information will be released;
  2. the signature of the person whose information will be released, or the parent or legal guardian of a person who is unable to provide authorization;
  3. the specific information to be released;
  4. the purpose for which the information is to be used;
  5. the date the release takes effect;
  6. the date, event, or condition upon which the consent expires in relation to the individual purpose for disclosure, not to exceed one year from when the release takes effect;
  7. the name of the person(s) or agency/agencies that will receive the disclosed information;
  8. the name of the person or agency that is disclosing the confidential information; and
  9. a statement that the person or family may withdraw their authorization at any time except to the extent that action has already been taken.

Interpretation

When a release form is used to authorize the exchange of information between multiple parties, the form must comply with all elements of the standard. All relevant parties must be authorized to disclose and receive the information specified, for the purpose indicated, in the consent.

Interpretation

 
Elements (b) and (i) will not apply when law, regulation, or court order permits confidential information to be released without the authorization of the person or legal guardian.

Interpretation

Blanket release forms signed by clients when service is initiated do not meet the requirements of this standard except as put forth by federal regulation, for example, when making application to FEMA/DHS in a declared disaster.
Examples: Examples of information that may also be included on release forms include a statement regarding the impact, if any, of refusing to sign the authorization, and rules regarding re-disclosure of information.